Better yet, why not pick a security auditor and have the bidder pay for it, as a condition for approval?